This vulnerability involves deserialization of untrusted data in the WP Gravity Forms Keap/Infusionsoft plugin by CRM Perks, specifically versions up to and including 1.2.3. The issue allows an attacker to perform object injection, which can lead to remote code execution or other severe impacts. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or fix is currently referenced.

Successful exploitation of this vulnerability can lead to complete compromise of the affected WordPress environment, including unauthorized disclosure, modification, or destruction of data, and potential full system takeover. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.